Re: HTTP Application Security (HAS) BoF

[Peter Saint-Andre <[e-mail]>]

We now have a dedicated list for this BoF:

https://www.ietf.org/mailman/listinfo/hasmat

Please discuss further on that list. I'll be blasting various lists and
individuals regarding the BoF.

On 6/2/10 8:11 AM, Peter Saint-Andre wrote:
> I've received a proposal to hold a birds of a feather (BoF) session at
> IETF 78 in Maastricht on the topic of HTTP Application Security.  A
> draft charter and agenda can be found below.  Please discuss on the
> [e-mail] list:
> 
> https://www.ietf.org/mailman/listinfo/apps-discuss
> 
> /psa
> 
> ###
> 
> Charter for HTTP Application Security (HAS) WG
> 
> Problem Statement
> 
> Although modern Web applications are built on top of HTTP, they provide
> rich functionality and have requirements beyond the original vision of
> static web pages.  HTTP, and the applications built on it, have evolved
> organically.  Over the past few years, we have seen a proliferation of
> AJAX-based web applications (AJAX being shorthand for asynchronous
> JavaScript and XML), as well as Rich Internet Applications (RIAs), based
> on so-called Web 2.0 technologies.  These applications bring both
> luscious eye-candy and convenient functionality, e.g. social networking,
> to their users, making them quite compelling.  At the same time, we are
> seeing an increase in attacks against these applications and their
> underlying technologies.
> 
> The list of attacks is long and includes Cross-Site-Request Forgery
> (CSRF)-based attacks, content-sniffing cross-site-scripting (XSS)
> attacks, attacks against browsers supporting anti-XSS policies,
> clickjacking attacks, malvertising attacks, as well as man-in-the-middle
> (MITM) attacks against "secure" (e.g. Transport Layer Security
> (TLS/SSL)-based) web sites along with distribution of the tools to carry
> out such attacks (e.g. sslstrip).
> 
> Objectives
> 
> With the arrival of new attacks the introduction of new web security
> indicators, security techniques, and policy communication mechanisms
> have sprinkled throughout the various layers of the Web and HTTP.
> 
> The goal of this working group is to standardize a small number of
> selected specifications that have proven to improve security of Internet
> Web applications. The requirements guiding the work will be taken from
> the Web application and Web security communities.  Initial work will be
> limited to the following topics:
> 
>    - Media type sniffing, as discussed in draft-abarth-mime-sniff
>    - Same origin policy, as discussed in draft-abarth-origin (expired)
>    - Strict transport security, as discussed in
>      draft-hodges-stricttransportsec (to be submitted shortly)
> 
> This working group will work closely with IETF Apps Area WGs (such as
> HYBI, HTTPstate, and HTTPbis), as well as W3C WebApps working group(s).
> 
> Deliverables
> 
> 1. A document illustrating the security problems Web applications are
> facing and listing design requirements.  This document shall be
> Informational.
> 
> 2. A selected set of technical specifications documenting deployed
> HTTP-based Web security solutions.
> These documents shall be Standards Track.
> 
> Goals and Milestones
> 
> Oct 2010    Submit "HTTP Application Security Problem Statement and
>             Requirements" as initial WG item.
> Oct 2010    Submit "Media Type Sniffing" as initial WG item.
> Oct 2010    Submit "Web Origin Concept" as initial WG item.
> Oct 2010    Submit "Strict Transport Security" as initial WG item.
> Feb 2011    Submit "HTTP Application Security Problem Statement and
>             Requirements" to the IESG for consideration as an
>             Informational RFC.
> Mar 2011    Submit "Media Type Sniffing" to the IESG for consideration
>             as a Standards Track RFC.
> Mar 2011    Submit "Web Origin Concept" to the IESG for consideration as
>             a Standards Track RFC.
> Mar 2011    Submit "Strict Transport Security" to the IESG for
>             consideration as a Standards Track RFC.
> Apr 2011    Possible re-chartering
> 
> ###
> 
> Agenda for HTTP Application Security (HAS) BoF, IETF 78
> 
> Chairs: Hannes Tschofenig and Jeff Hodges (to be finalized)
> 
> 5 min   Agenda bashing (Chairs)
> 
> 10 min  Description of the problem space (TBD)
> 
> 20 min  Motivation for standardizing (TBD)
>         draft-abarth-mime-sniff
>         draft-abarth-origin
>         draft-hodges-stricttransportsec
> 
> 15 min  Presentation of charter text (TBD)
> 
> 60 min  Discussion of charter text and choice of the initial
> specifications (All)
> 
> 10 min  Conclusion (Chairs/ADs)
> 
> ###
> 
>